Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I Have The System Alert Problem Too


  • Please log in to reply
3 replies to this topic

#1 MunchiesMommie

MunchiesMommie

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:02:45 AM

Posted 11 June 2006 - 03:10 PM

I too sat down to the computer one morning and had tons of pop-ups, including the little flashing yellow triangle telling me I was infected with spyware. Also, Internet Explorer would not load on my computer.

I had a friend send me the exe file for Mozilla so I could get onto the internet.

I ran my Anti-Virus software (McAfee) several times and it found nothing. So then I rebooted in Safe Mode, ran SpyBot, AdAware, and CCleaner. Then I started normal mode and ran my AntiVirus.

Now I can open IE, but my homepage has been changed to that Security Center one, in Internet Options it shows my homepage as about:blank and when I try to change it, it just reverts back to about:blank. Does that mean that I didn't get everything out with the programs I ran? I downloaded HijackThis and here is my logfile:

Logfile of HijackThis v1.99.1
Scan saved at 1:03:44 PM, on 6/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\mcafee.com\vso\mcmnhdlr.exe
c:\program files\mcafee.com\shared\mghtml.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Alyssa\LOCALS~1\Temp\Rar$EX01.030\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee Privacy Service Popup Blocker - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm
O12 - Plugin for .hlq: C:\Program Files\Internet Explorer\PLUGINS\NpHcd32.dll
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://about.chatspace.com/Java/cfs40300.cab
O16 - DPF: ppctlcab - http://www.my-etrust.com/includes/pscanner/ppctlcab.CAB
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha...t/c381/chat.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://66.48.68.135/save/makeover.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://millerfamily.aboutmybaby.com/saxfile.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab30149.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha...v45/yacscom.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.my-etrust.com/includes/pscanner/axscanner.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-36.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6ED071F6-540F-4B17-B444-DC6A78CE0B0F} - https://www.opinionsquare.com/globalconfig/ngc_activex.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {CA797B15-445F-4AA9-9828-8A88502F560F} (Uninstall Control) - http://www.worldwinner.com/games/shared/uninstall.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?316
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by104fd.bay104.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab30149.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: pushow44.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)


Thanks in advance if anyone can help me!!!

BC AdBot (Login to Remove)

 


#2 Guest_Cretemonster_*

Guest_Cretemonster_*

  • Guests
  • OFFLINE
  •  

Posted 13 June 2006 - 04:33 PM

Hi MunchiesMommie and Welcome to the Bleeping Computer!


Download smitRem.exe ©noahdfear, and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop (in Internet Explorer, right click on Panda ActiveScan link select "Copy Shortcut" then right click on your desktop and select "Paste Shortcut" or in FireFox right-click the link and select "Save Link As" and save it to your desktop).

Please download the trial version of ewido anti-malware here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

Next, please reboot your computer in SafeMode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear
  • Select the first option, to run Windows in Safe Mode.
Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • While the scan is in progress you will be prompted to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Close ewido anti-malware.

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut.
  • Once you are on the Panda site click the Scan your PC button.
  • A new window will open...click the Check Now button.
    • Enter your Country
    • Enter your State/Province
    • Enter your e-mail address and click send
    • Select either Home User or Company
    • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When the download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.
Let us know if any problems persist.

#3 MunchiesMommie

MunchiesMommie
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  

Posted 13 June 2006 - 10:35 PM

Panda Scan


Incident Status Location

Adware:adware/igetnet Not disinfected c:\windows\system\rules.dat
Adware:adware/toprebates Not disinfected c:\windows\downloaded program files\WinadX.inf
Spyware:spyware/betterinet Not disinfected c:\windows\inf\satmat.inf
Adware:adware/ieplugin Not disinfected c:\windows\kwv2.dat
Adware:adware/savenow Not disinfected c:\program files\VVSN
Adware:adware/winad Not disinfected c:\program files\Winad Client
Adware:adware/sidesearch Not disinfected C:\Documents and Settings\Alyssa\Application Data\Lycos
Adware:adware/topmoxie Not disinfected Windows Registry
Dialer:dialer.b Not disinfected HKEY_CLASSES_ROOT\Interface\{8F0A06F6-DF4D-4D54-B8CA-E8EEDBAE6DDB}
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt[.belnk.com/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alyssa\Cookies\alyssa@belnk[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Alyssa\Cookies\alyssa@dist.belnk[2].txt
Spyware:Cookie/SecurityError Not disinfected C:\Documents and Settings\Alyssa\Cookies\alyssa@www.safetyuptodate[2].txt
Spyware:Cookie/SecurityError Not disinfected C:\Documents and Settings\Alyssa\Cookies\alyssa@www.safetyuptodate[3].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Alyssa\Desktop\smitRem\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Alyssa\Desktop\smitRem.exe[smitRem/Process.exe]


HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 8:28:37 PM, on 6/13/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\Program Files\Shareaza\Shareaza.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Alyssa\LOCALS~1\Temp\Rar$EX00.096\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee Privacy Service Popup Blocker - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm
O12 - Plugin for .hlq: C:\Program Files\Internet Explorer\PLUGINS\NpHcd32.dll
O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://about.chatspace.com/Java/cfs40300.cab
O16 - DPF: ppctlcab - http://www.my-etrust.com/includes/pscanner/ppctlcab.CAB
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha...t/c381/chat.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://66.48.68.135/save/makeover.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://millerfamily.aboutmybaby.com/saxfile.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab30149.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha...v45/yacscom.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.my-etrust.com/includes/pscanner/axscanner.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-36.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6ED071F6-540F-4B17-B444-DC6A78CE0B0F} - https://www.opinionsquare.com/globalconfig/ngc_activex.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {CA797B15-445F-4AA9-9828-8A88502F560F} (Uninstall Control) - http://www.worldwinner.com/games/shared/uninstall.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?316
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by104fd.bay104.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab30149.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: pushow44.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)


Smitfiles.txt

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 7:59:36 PM, 6/13/2006
+ Report-Checksum: 939F9D5D

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\Windows ServeAd -> Adware.BlazeFind : Cleaned with backup
HKU\S-1-5-21-1454471165-1580818891-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\unebmm350 -> Adware.MoneyMaker : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Bfast : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.141:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.142:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.201:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.202:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.203:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.204:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.210:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.251:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.253:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.254:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\0p6ygacm.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
C:\Documents and Settings\Alyssa\Cookies\alyssa@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Alyssa\Cookies\alyssa@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Alyssa\Cookies\alyssa@as.casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\Alyssa\Cookies\alyssa@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Alyssa\Cookies\alyssa@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Downloads\GoldMinerSetup-dm[1].exe -> Adware.Trymedia : Cleaned with backup
C:\Program Files\Media-Codec -> Trojan.Small : Cleaned with backup
C:\Program Files\Media-Codec\uninst.exe -> Trojan.Small : Cleaned with backup


::Report End


Panda scan didn't delete the problems it found...should I just find all those programs and delete them now? Thank you, thank you, thank you for all your help!!!

Edited by MunchiesMommie, 13 June 2006 - 10:36 PM.


#4 Guest_Cretemonster_*

Guest_Cretemonster_*

  • Guests
  • OFFLINE
  •  

Posted 14 June 2006 - 03:46 AM

Copy all the text in the quote box to a blank notepad page and Save it to the desktop with the name Clr.reg but dont run it just yet.


REGEDIT4

[-HKEY_CLASSES_ROOT\Interface\{8F0A06F6-DF4D-4D54-B8CA-E8EEDBAE6DDB}]




Download RemAdvertisemen to a convenient place and double click the remadvertisemen.exe.

Once it is running click the "Start Removal" button and wait for the "Done Removal! Please reboot your computer now." message.

Once you see that Click ok and then reboot your computer.


Restart in Safe Mode and delete any of these found

c:\windows\system\rules.dat<-- File

c:\windows\downloaded program files\WinadX.inf<-- File

c:\windows\inf\satmat.inf<-- File

c:\windows\kwv2.dat<-- File

c:\program files\VVSN<-- File

c:\program files\Winad Client<-- File

C:\Documents and Settings\Alyssa\Application Data\Lycos<-- File


Locate and Double Click Clr.reg and allow it to merge into the registry.


Restart Normal and Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!
  • Follow the Instruction on the F-Secure page for proper installation.
  • Accept the License Agreement.
  • Once the ActiveX installs,Click Full System Scan
  • Once the download completes,the scan will begin automatically.
  • The scan will take some time to finish,so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and Copy&Paste the entire report in your next reply along with a fresh HijackThis log





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users