Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With Surf Sidekick 3 And Cant Get Rid Out It.


  • This topic is locked This topic is locked
14 replies to this topic

#1 McCreadyAdam

McCreadyAdam

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 02 April 2006 - 05:32 PM

Okay so I have SurfSideKick 3 on my computer and I cant get rid of it. Its not in the Add/Remove programs
and theres no uninstall file in it ether. I know where it is in my program files but it will not delete. I also get constant popups without being on Internet Explorer, so I think this is what Surf Side Kick 3 does. I have run Norton Antivirus, Ad-Aware and Ewido Anti-Malware serveral times hoping something would work, but nothing has worked. I was recommended to post on this forum because you guys know what your talking about. Anyways hopeully you can help me out here. I looked and saw someone else had a similar problem so hopefully you may be able to help me or put me in the right direction to get this fixed.

Logfile of HijackThis v1.99.1
Scan saved at 6:26:38 PM, on 4/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\WordPerfect Office 11\Programs\DAD11.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Desktop\Virus Stuff\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [outlook] C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE /auto
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [Hoeh] C:\Documents and Settings\User\Application Data\o???.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Application Director 11.lnk = ?
O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1121159248609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128623381625
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab
O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: repairs303169566.dll
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\h84m0ih1e84.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

BC AdBot (Login to Remove)

 


#2 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 04 April 2006 - 08:00 AM

Hello and welcome to the site.. :thumbsup:

Please print these instructions out, or write them down, as you can't read them during the fix.

Please download Look2Me-Destroyer to your desktop.

Before continuing with the fix there is something you must do:
  • Click Start -> Run and type in: services.msc
  • Check that the following services are running and that their startup is set to automatic:
  • Seclogon, or Secondary logon service
  • Next your machine needs to be offline, manually disconnect the network cable if necessary.
  • Your antivirus, and every other security software MUST be disabled.
Now continue:
  • Double-click Look2Me-Destroyer.exe to run it.
  • Put a check next to Run this program as a task.
  • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
  • When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
  • Once it's done scanning, click the Remove L2M button.
  • You will receive a Done Scanning message, click OK.
  • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
  • Your computer will then shutdown.
  • Turn your computer back on.
  • Re-launch your Anti-virus/Firewall protection.
  • Re-connect back to the internet.
  • Please post the contents of C:\Look2Me-Destroyer.txt and a fresh HiJackThis log. :flowers:
If Look2Me-Destroyer does not reopen automatically, reboot and try again.
Hi there, stranger!

#3 McCreadyAdam

McCreadyAdam
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 05 April 2006 - 09:26 PM

Hey thanks for helping me out with my problem here. Sorry its been a day or two since you repsonded, the day after you sent your reply my internet supplier went down so I was without internet for a day and a half. Im also a studnet but I will try to get the responses bcak as fast as possible. Thanks again for helping me out.
ADAM
----------------------------------------------------------------------------------------------------------------------------
Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 4/5/2006 9:44:12 PM

Infected! C:\WINDOWS\system32\s6pu0g79e6.dll
Infected! C:\RECYCLER\NPROTECT\00048046.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP10\A0005370.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP3\A0000072.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0000456.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001267.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001391.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001408.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001420.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001700.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001737.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001831.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP9\A0003237.dll
Infected! C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP9\A0003303.dll
Infected! C:\WINDOWS\system32\cqmcat.dll
Infected! C:\WINDOWS\system32\s4rsle971h.dll
Infected! C:\WINDOWS\system32\s6pu0g79e6.dll
Infected! C:\WINDOWS\system32\guard.tmp

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\s6pu0g79e6.dll
C:\WINDOWS\system32\s6pu0g79e6.dll Deleted successfully!

Attempting to delete: C:\RECYCLER\NPROTECT\00048046.dll
C:\RECYCLER\NPROTECT\00048046.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP10\A0005370.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP10\A0005370.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP3\A0000072.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP3\A0000072.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0000456.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0000456.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001267.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001267.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001391.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001391.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001408.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001408.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001420.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP5\A0001420.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001700.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001700.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001737.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001737.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001831.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP8\A0001831.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP9\A0003237.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP9\A0003237.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP9\A0003303.dll
C:\System Volume Information\_restore{A2C3636A-5216-4350-8ECD-5E43E9E2EB55}\RP9\A0003303.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\cqmcat.dll
C:\WINDOWS\system32\cqmcat.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\s4rsle971h.dll
C:\WINDOWS\system32\s4rsle971h.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\s6pu0g79e6.dll
C:\WINDOWS\system32\s6pu0g79e6.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Applets

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{EC4A531F-1C42-4E20-8436-4C937D4EDFCA}"
HKCR\Clsid\{EC4A531F-1C42-4E20-8436-4C937D4EDFCA}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A3F40C50-AF4D-4E18-A6B7-0F54804CF12A}"
HKCR\Clsid\{A3F40C50-AF4D-4E18-A6B7-0F54804CF12A}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{96A91B09-79B7-498E-BCE6-AEA4D8BEC85E}"
HKCR\Clsid\{96A91B09-79B7-498E-BCE6-AEA4D8BEC85E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{964C98E4-5FE2-45A6-9753-C093A3D5C72C}"
HKCR\Clsid\{964C98E4-5FE2-45A6-9753-C093A3D5C72C}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CBB963D9-4AB6-4E9D-A558-F2B460BF2A2E}"
HKCR\Clsid\{CBB963D9-4AB6-4E9D-A558-F2B460BF2A2E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{46B44705-A339-4A12-A521-7256B5A9846D}"
HKCR\Clsid\{46B44705-A339-4A12-A521-7256B5A9846D}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{81AC0685-70B8-496F-83BC-733D2AC84B82}"
HKCR\Clsid\{81AC0685-70B8-496F-83BC-733D2AC84B82}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded

----------------------------------------------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 9:56:28 PM, on 4/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\WordPerfect Office 11\Programs\DAD11.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\User\Desktop\Virus Stuff\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [outlook] C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE /auto
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [Hoeh] C:\Documents and Settings\User\Application Data\o???.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Application Director 11.lnk = ?
O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1121159248609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128623381625
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab
O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: repairs303169566.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

#4 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 06 April 2006 - 02:48 AM

Lets continue. Few more steps :thumbsup:

Please download Brute Force Uninstaller to your desktop.
  • Right-click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk ( C: ) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download SideKickFix.
Save it in the same folder you made earlier (c:\BFU).

Please close ALL other open windows & explorer folder's, then double-click on sidekickFix.bat.
Click YES and follow the prompts, when prompted to restart the PC please do so.
Then please post back with a fresh HijackThis log by using AddReply. :flowers:
Hi there, stranger!

#5 McCreadyAdam

McCreadyAdam
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 06 April 2006 - 06:39 AM

Heres the new HiJackThis log.

-----------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 7:36:43 AM, on 4/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\WordPerfect Office 11\Programs\DAD11.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Desktop\Virus Stuff\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [outlook] C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [Hoeh] C:\Documents and Settings\User\Application Data\o???.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Application Director 11.lnk = ?
O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1121159248609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128623381625
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab
O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

#6 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 06 April 2006 - 09:54 AM

Hi again :thumbsup:

Please go HERE to run Panda's ActiveScan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report.

Hi there, stranger!

#7 McCreadyAdam

McCreadyAdam
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 06 April 2006 - 11:35 AM

Incident Status Location

Spyware:spyware/surfsidekick Not disinfected C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Ssk.log
Adware:adware/gator Not disinfected C:\WINDOWS\GatorHDPlugin.log-old.log
Adware:adware/adurl Not disinfected C:\WINDOWS\icont.exe
Adware:adware/dollarrevenue Not disinfected C:\WINDOWS\keyboard71.dat
Spyware:application/bestoffer Not disinfected C:\WINDOWS\smdat32m.sys
Adware:adware/commad Not disinfected Windows Registry
Dialer:dialer.asl Not disinfected HKEY_CLASSES_ROOT\CLSID\{A1426AC5-8CE5-4A00-B71E-011D35709AC6}
Potentially unwanted tool:application/altnet Not disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\ALTNETDM
Adware:adware/searchexe Not disinfected Windows Registry
Spyware:Cookie/Kmpads Not disinfected C:\Documents and Settings\User\Cookies\user@kmpads[2].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\yifybmah.slt\cookies.txt[.apmebf.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\yifybmah.slt\cookies.txt[.maxserving.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[.tickle.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.atdmt.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.2o7.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.advertising.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.winfixer.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.bfast.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.hitbox.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Date Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.date.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.com.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.errorsafe.com/]
Spyware:Cookie/Advnt Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[www.advnt01.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.as-us.falkag.net/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.bravenet.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.statcounter.com/]
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.888.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.realmedia.com/]
Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.targetnet.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Rn11 Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.rn11.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[server.iad.liveperson.net/hc/39742833]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.adtech.de/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.burstnet.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.questionmarket.com/]
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.www.myaffiliateprogram.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.xiti.com/]
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[www.myaffiliateprogram.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[39742833]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\yifybmah.slt\cookies.txt[]
Spyware:Cookie/Kmpads Not disinfected C:\Documents and Settings\User\Cookies\user@kmpads[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047190.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047190.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047190.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047191.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047191.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047191.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047192.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047192.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047192.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047193.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047193.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047193.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047194.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047194.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047194.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047195.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047195.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047195.MOZ[]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047196.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047196.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047196.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047197.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047197.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047197.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047198.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047198.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047198.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047199.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047199.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047199.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047200.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047200.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047200.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047201.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047201.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047201.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047202.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047202.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047202.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047203.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047203.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047203.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047204.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047204.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047204.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047205.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047205.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047205.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047212.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047212.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047212.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047213.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047213.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047213.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047214.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047214.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047214.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047215.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047215.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047215.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047216.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047216.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047216.MOZ[]
Spyware:Cookie/2o7 Not disinfected C:\RECYCLER\NPROTECT\00047217.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047217.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047217.MOZ[]
Spyware:Cookie/2o7 Not disinfected C:\RECYCLER\NPROTECT\00047228.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047228.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047228.MOZ[]
Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00047229.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047229.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047229.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047230.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047230.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047230.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047232.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047232.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047232.MOZ[]
Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00047233.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047233.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047233.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047234.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047234.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047234.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047235.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047235.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047235.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047236.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047236.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047236.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047245.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047245.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047245.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047246.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047246.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047246.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047247.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047247.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047247.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047248.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047248.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047248.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047249.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047249.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047249.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047250.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047250.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT&#

#8 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 06 April 2006 - 11:39 AM

It got cut off.. Please post the entire log and then we can continue :thumbsup:
Hi there, stranger!

#9 McCreadyAdam

McCreadyAdam
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 06 April 2006 - 11:45 AM

Sorry about that!!! Heres the whole thing..... its alittle messed up because it is a wide file so things are all jumbled up.

--------------------------------------------------------------------------------------------------------------------------------

Incident Status Location

Spyware:spyware/surfsidekick Not disinfected C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Ssk.log
Adware:adware/gator Not disinfected C:\WINDOWS\GatorHDPlugin.log-old.log
Adware:adware/adurl Not disinfected C:\WINDOWS\icont.exe
Adware:adware/dollarrevenue Not disinfected C:\WINDOWS\keyboard71.dat
Spyware:application/bestoffer Not disinfected C:\WINDOWS\smdat32m.sys
Adware:adware/commad Not disinfected Windows Registry
Dialer:dialer.asl Not disinfected HKEY_CLASSES_ROOT\CLSID\{A1426AC5-8CE5-4A00-B71E-011D35709AC6}
Potentially unwanted tool:application/altnet Not disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\ALTNETDM
Adware:adware/searchexe Not disinfected Windows Registry
Spyware:Cookie/Kmpads Not disinfected C:\Documents and Settings\User\Cookies\user@kmpads[2].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\yifybmah.slt\cookies.txt[.apmebf.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\yifybmah.slt\cookies.txt[.maxserving.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[.tickle.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.fastclick.net/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.atdmt.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.2o7.net/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.advertising.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.winfixer.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.bfast.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.hitbox.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Date Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.date.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.trafficmp.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.com.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.errorsafe.com/]
Spyware:Cookie/Advnt Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[www.advnt01.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.as-us.falkag.net/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.bravenet.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.statcounter.com/]
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.888.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.realmedia.com/]
Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.targetnet.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Rn11 Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.rn11.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[server.iad.liveperson.net/hc/39742833]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.adtech.de/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.burstnet.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.questionmarket.com/]
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.www.myaffiliateprogram.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[.xiti.com/]
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[www.myaffiliateprogram.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\d75v0oh5.default\cookies.txt[]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[39742833]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\spiu9p6q.Adam\cookies.txt[]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\yifybmah.slt\cookies.txt[]
Spyware:Cookie/Kmpads Not disinfected C:\Documents and Settings\User\Cookies\user@kmpads[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047190.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047190.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047190.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047191.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047191.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047191.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047192.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047192.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047192.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047193.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047193.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047193.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047194.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047194.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047194.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047195.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047195.MOZ[39742833]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047195.MOZ[]
Spyware:Cookie/ErrorSafe Not disinfected C:\RECYCLER\NPROTECT\00047196.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047196.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047196.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047197.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047197.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047197.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047198.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047198.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047198.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047199.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047199.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047199.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047200.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047200.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047200.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047201.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047201.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047201.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047202.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047202.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047202.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047203.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047203.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047203.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047204.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047204.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047204.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047205.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047205.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047205.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047212.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047212.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047212.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047213.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047213.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047213.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047214.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047214.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047214.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047215.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047215.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047215.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047216.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047216.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047216.MOZ[]
Spyware:Cookie/2o7 Not disinfected C:\RECYCLER\NPROTECT\00047217.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047217.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047217.MOZ[]
Spyware:Cookie/2o7 Not disinfected C:\RECYCLER\NPROTECT\00047228.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047228.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047228.MOZ[]
Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00047229.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047229.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047229.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047230.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047230.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047230.MOZ[]
Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\NPROTECT\00047232.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047232.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047232.MOZ[]
Spyware:Cookie/WinFixer Not disinfected C:\RECYCLER\NPROTECT\00047233.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047233.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047233.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047234.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047234.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047234.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047235.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047235.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047235.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047236.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047236.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047236.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047245.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047245.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047245.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047246.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047246.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047246.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047247.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047247.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047247.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047248.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047248.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047248.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047249.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047249.MOZ[39742833]
Spyware:Cookie/Adserver Not disinfected C:\RECYCLER\NPROTECT\00047249.MOZ[]
Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\NPROTECT\00047250.MOZ[]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00047250.MOZ[39742833]

#10 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 06 April 2006 - 11:47 AM

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

==

Next:

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.
  • Save it to your desktop.
  • Please double-click Killbox.exe to run it.
  • Select:
    • Delete on Reboot
    • then Click on the All Files button.
  • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\GatorHDPlugin.log-old.log
    C:\WINDOWS\icont.exe
    C:\WINDOWS\keyboard71.dat
    C:\WINDOWS\smdat32m.sys


  • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

==

Post back with a fresh HijackThis log. :thumbsup:
Hi there, stranger!

#11 McCreadyAdam

McCreadyAdam
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 06 April 2006 - 03:33 PM

Logfile of HijackThis v1.99.1
Scan saved at 4:31:27 PM, on 4/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\program files\valve\steam\steam.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\WordPerfect Office 11\Programs\DAD11.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Desktop\Virus Stuff\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [outlook] C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [Hoeh] C:\Documents and Settings\User\Application Data\o???.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Desktop Application Director 11.lnk = ?
O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1121159248609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128623381625
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab
O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Program Files\Roxio\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

#12 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 07 April 2006 - 08:42 AM

Hi again.. :thumbsup:

Go ahead and delete Look2Me-Destroyer, Brute Force Uninstaller aswell as SideKickFix.

==

Please copy the following text in the quotebox below to a blank Notepad file. Make sure the filetype is set to "All Files" and save it as Fixit.reg to your desktop.

REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{A1426AC5-8CE5-4A00-B71E-011D35709AC6}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\ALTNETDM]


Now double-click on the Fixit.reg on your desktop and allow it to merge with registry by clicking YES on the prompt.

==

Then please run a scan with HijackThis and check the following objects for removal:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O4 - HKCU\..\Run: [Hoeh] C:\Documents and Settings\User\Application Data\o???.exe


Now close ALL other open windows except for HijackThis and hit FIX CHECKED. Close HijackThis.

==

Delete the following file if present:

C:\Documents and Settings\User\Application Data\o???.exe

Now run ATF-Cleaner with the same instructions as earlier. Please reboot.

==

How's the system running now? :flowers:
Hi there, stranger!

#13 McCreadyAdam

McCreadyAdam
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:05:29 AM

Posted 07 April 2006 - 10:19 AM

Absolutely Amazing..... thank you soo much. Im back to normal thanks for all the help. I am definately going to recommend this forum for other problems people have, Thanks alot again.

#14 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 07 April 2006 - 03:38 PM

You're most welcome :thumbsup:

==

Please read here how to clear old restore points and create a new one.

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Here's some tips for future to prevent spyware;

Detect and Remove Programs:
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
Prevention Programs:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed. (My favourite)
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Other necessary Programs:
  • AntiVirus Program <= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kaspersky, this is a must have.
  • Firewall <= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
  • More Secure Browser <= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox.
And also see TonyKlein's good advice;
So how did I get infected in the first place? (My favourite)
Hi there, stranger!

#15 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:29 PM

Posted 08 April 2006 - 06:49 PM

Since this issue appears to be resolved, this Topic has been closed. Should you need this Topic reopened, please PM a Staff member with the address of this thread. :thumbsup:
Hi there, stranger!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users