Here is the virustotal scan of svcbces.exe: Antivirus Version Update Result AhnLab-V3 2007.4.4.0 04.03.2007 no virus found AntiVir 7.3.1.48 04.03.2007 TR/Crypt.ULPM.Gen Authentium 4.93.8 04.03.2007 no virus found Avast 4.7.936.0 04.03.2007 no virus found AVG 7.5.0.447 04.03.2007 no virus found BitDefender 7.2 04.03.2007 no virus found CAT-QuickHeal 9.00 04.03.2007 no virus found ClamAV devel-20070312 04.04.2007 no virus found DrWeb 4.33 04.04.2007 no virus found eSafe 7.0.15.0 04.03.2007 suspicious Trojan/Worm eTrust-Vet 30.6.3538 04.04.2007 no virus found Ewido 4.0 04.03.2007 no virus found FileAdvisor 1 04.04.2007 no virus found Fortinet 2.85.0.0 04.04.2007 no virus found F-Prot 4.3.1.45 04.03.2007 no virus found F-Secure 6.70.13030.0 04.03.2007 no virus found Ikarus T3.1.1.3 04.03.2007 no virus found Kaspersky 4.0.2.24 04.04.2007 no virus found McAfee 4999 04.03.2007 W32/Sdbot.worm.gen.g Microsoft 1.2306 04.03.2007 no virus found NOD32v2 2167 04.03.2007 no virus found Norman 5.80.02 04.03.2007 no virus found Panda 9.0.0.4 04.03.2007 Suspicious file Prevx1 V2 04.04.2007 no virus found Sophos 4.16.0 03.30.2007 Mal/HckPk-A Sunbelt 2.2.907.0 04.03.2007 no virus found Symantec 10 04.04.2007 no virus found TheHacker 6.1.6.084 04.02.2007 no virus found VBA32 3.11.3 04.03.2007 no virus found VirusBuster 4.3.7:9 04.03.2007 Worm.SdBot.Gen.30 Webwasher-Gateway 6.0.1 04.03.2007 Trojan.Crypt.ULPM.Gen Aditional Information File size: 37376 bytes MD5: 1691d1b187aea9f950e649adcbbd30bc SHA1: b47b5a99d31fa4b2e86086897e492bc0a8cb2f1a Vundofix log: VundoFix V6.3.19 Checking Java version... Java version is 1.5.0.4 Old versions of java are exploitable and should be removed. Java version is 1.5.0.6 Old versions of java are exploitable and should be removed. Scan started at 7:42:48 PM 4/3/2007 Listing files found while scanning.... C:\WINDOWS\system32\mljjgda.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\mljjgda.dll C:\WINDOWS\system32\mljjgda.dll Has been deleted! Performing Repairs to the registry. Done!

0

Go to start> control panel> administrative tools> services> scroll down to "Terminal Shadow Copy (tscbces)"> click stop (if stop does not respond continue)> on the far right side of "startup type" click the drop down arrow> click disabled> apply> ok. Exit services. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O15 - Trusted Zone: http://*.anyoneseenthebridge.com (if you did not put this in the trusted zone delete it) O15 - Trusted Zone: http://www.cingular.com (if you did not put this in the trusted zone delete it) O15 - Trusted Zone: http://*.citizensbank.com (if you did not put this in the trusted zone delete it) O15 - Trusted Zone: http://*.nancies.org (if you did not put this in the trusted zone delete it) O15 - Trusted Zone: http://*.nyyfans.com (if you did not put this in the trusted zone delete it) O23 - Service: Terminal Shadow Copy (tscbces) - Unknown owner - C:\WINDOWS\system32\svcbces.exe Exit Hijack This. Navigate to and delete this file if found: C:\WINDOWS\system32\svcbces.exe Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the AVG report, a new Hijack This log and a new combofix log please.

0

AVG Report: AVG Anti-Spyware - Scan Report + Created at: 11:02:06 PM 4/3/2007 + Scan result: C:\Program Files\DIGStream\digstream.exe -> Not-A-Virus.Downloader.Win32.DigStream.a : Cleaned. :mozilla.245:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.247:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.249:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.250:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.251:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.252:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.253:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.254:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.255:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.369:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.273:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.274:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.275:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.174:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned. :mozilla.285:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.286:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.287:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.298:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.299:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.302:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.360:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.361:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.58:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.59:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.60:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.61:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.62:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.49:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.332:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.386:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.387:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.388:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.389:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.390:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.51:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned. :mozilla.47:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.48:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.50:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned. :mozilla.267:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.268:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.269:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.46:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned. :mozilla.20:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.233:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.234:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.236:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.237:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned. :mozilla.238:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.239:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.240:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.241:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.101:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.102:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.103:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.104:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.105:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.106:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.107:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.35:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.36:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.173:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.276:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.261:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.262:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.263:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.264:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.265:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.56:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.57:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.308:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.309:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.310:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.311:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.312:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.305:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.306:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.307:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.363:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.364:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.365:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.366:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.367:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.368:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.380:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.381:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.382:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.383:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.384:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.385:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned. :mozilla.283:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.284:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.67:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.68:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.73:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.74:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.75:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.76:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.77:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.321:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.162:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.163:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.164:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.165:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.166:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.167:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.168:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.169:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.17:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.18:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.343:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.345:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.346:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.347:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.348:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.349:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Valuead : Cleaned. :mozilla.227:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.139:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.140:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.144:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.146:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.300:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.301:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.303:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.304:C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\8yzyin0g.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. ::Report end Hijack this: Logfile of HijackThis v1.99.1 Scan saved at 11:05:46 PM, on 4/3/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 221.224.33.227:80 O1 - Hosts: 17.250.248.77 idisk0.mac.com idisk1.mac.com idisk2.mac.com idisk3.mac.com idisk4.mac.com idisk5.mac.com idisk6.mac.com idisk7.mac.com idisk8.mac.com idisk9.mac.com idisk10.mac.com idisk11.mac.com idisk12.mac.com idisk13.mac.com idisk14.mac.com idisk15.mac.com idisk16.mac.com idisk17.mac.com idisk18.mac.com idisk19.mac.com idisk20.mac.com idisk21.mac.com idisk22.mac.com idisk23.mac.com idisk24.mac.com idisk25.mac.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.exe O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\SCROLL MOUSE\SCROLL MOUSE\4.0\lwbwheel.exe O4 - HKLM\..\Run: [PmProxy] C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Enterprise O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: NETGEAR Smart Wizard.lnk = ? O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06... O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: lmab_device - - C:\WINDOWS\system32\LMabcoms.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe Combofix: "Jeff" - 07-04-03 23:07:12 Service Pack 2 ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Jeff\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2007-03-03 to 2007-04-03 )))))))))))))))))))))))))))))))))) 2007-04-03 21:23 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-04-03 19:42 97,280 --a------ C:\VundoFix.exe 2007-04-03 19:42 <DIR> d-------- C:\VundoFix Backups 2007-03-26 19:23 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-03-05 22:08 <DIR> d-------- C:\DOCUME~1\JEFF~1\APPLIC~1\WinRAR 2007-03-05 22:07 1,201,917 --a------ C:\Program Files\wrar37b4.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-03 23:02 -------- d-------- C:\Program Files\digstream 2007-04-02 21:15 -------- d-------- C:\Program Files\sas 2007-04-02 21:13 -------- d--h----- C:\Program Files\installshield installation information 2007-03-26 20:17 -------- d-------- C:\Program Files\symantec 2007-03-26 19:09 -------- d-------- C:\Program Files\norton antivirus 2007-02-21 21:02 -------- d-------- C:\Program Files\itunes 2007-02-21 21:00 458752 --a------ C:\Program Files\iconcertcal_v1_1.msi 2007-02-19 14:48 -------- d-------- C:\Program Files\lexmark_hostcd 2007-02-19 14:47 -------- d-------- C:\Program Files\lexmark 2007-02-14 22:30 -------- d-------- C:\Program Files\deductionpro 2006 2007-02-06 08:36 -------- d-------- C:\Program Files\google 2007-02-03 19:36 -------- d-------- C:\Program Files\taxcut06 2007-02-03 19:33 51716 --a------ C:\WINDOWS\system32\pdf995mon.dll 2007-02-03 19:33 118784 --a------ C:\WINDOWS\system32\pdfmona.dll 2007-01-29 21:55 458240 --a------ C:\Program Files\iconcertcal.msi 2007-01-24 16:27 255848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-01-08 20:01 17408 --a------ C:\WINDOWS\system32\corpol.dll 2007-01-08 16:30 15128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "00THotkey"="C:\\WINDOWS\\System32\\00THotkey.exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "TouchED"="C:\\Program Files\\TOSHIBA\\TouchED\\TouchED.exe" "Pinger"="c:\\toshiba\\ivp\\ism\\pinger.exe /run" "LWBMOUSE"="C:\\Program Files\\SCROLL MOUSE\\SCROLL MOUSE\\4.0\\lwbwheel.exe" "PmProxy"="C:\\Program Files\\Analog Devices\\SoundMAX\\PmProxy.exe" "WG511WLU"="C:\\Program Files\\NETGEAR\\WG511\\Utility\\WG511WLU.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Enterprise" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\RAMASST.lnk" "backup"="C:\\WINDOWS\\pss\\RAMASST.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\system32\\RAMASST.exe " "item"="RAMASST" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\000StTHK] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="000StTHK" "hkey"="HKLM" "command"="000StTHK.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AGRSMMSG" "hkey"="HKLM" "command"="AGRSMMSG.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Apoint" "hkey"="HKLM" "command"="C:\\Program Files\\Apoint2K\\Apoint.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ctfmon" "hkey"="HKCU" "command"="C:\\WINDOWS\\system32\\ctfmon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGStream] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="digstream" "hkey"="HKLM" "command"="C:\\Program Files\\DIGStream\\digstream.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SNDMon" "hkey"="HKLM" "command"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TFNF5" "hkey"="HKLM" "command"="TFNF5.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tpwrtray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="TPWRTRAY" "hkey"="HKLM" "command"="TPWRTRAY.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ALUAlert"="C:\\Program Files\\Symantec\\LiveUpdate\\ALUNotify.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4302df96-8dec-11db-8c58-00146c70d5ea}] Shell\AutoRun\command E:\LaunchU3.exe -a *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVGASCLN Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\Symantec NetDetect.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-03 23:12:34 C:\ComboFix2.txt ... 07-04-02 23:36

0

You Hijack This log is clean. How is your computer operating? Your java is out of date and can cause your computer to get reinfected. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version.

0

Seems to be running fine so far. I'll come back if anything acts up. Thanks so much for your time and help. I'll update my java as well. Thanks!

0

Glad we could help.

0